How to Prevent Sensitive Data in Amazon SNS Messages?
Short answer
A Associate an Amazon SNS data protection policy with the topic and define statements that identify and redact sensitive data before publication.
Question
The company wants to prevent sensitive data from being published to the SNS topic.
Which solution will meet these requirements?
Key Takeaways
The exam tests whether you know SNS data protection policies operate on message content, not just access control; the trap is choosing a discovery or threat-detection service that cannot redact the publication path.
This question tests how to stop sensitive data from reaching an Amazon SNS topic that external stakeholders subscribe to. The answer is A: an SNS data protection policy can identify and redact sensitive data in published messages.
Common mistake: A common mistake is selecting Amazon Macie because it finds sensitive data, but Macie scopes S3 data discovery and does not inspect or redact SNS messages in transit.
Expert Analysis
Why the Answer Is Correct
Amazon SNS data protection policies are designed for message content protection. You associate the policy with the SNS topic and define statements using data identifiers and actions such as audit, deny, or redact. That means sensitive data can be detected and prevented from being published, or masked before external subscribers receive it. Option A directly applies the native SNS control to the Lambda-to-SNS publication path.
Why the Other Options Are Wrong
Amazon Macie discovers and classifies sensitive data in Amazon S3; it does not intercept SNS publishes or redact message payloads in a Lambda workflow. GuardDuty Lambda Protection looks for runtime threats and suspicious activity, not custom sensitive-data patterns with redaction actions. Amazon Inspector scans Lambda code and dependencies for vulnerabilities and does not inspect runtime message content. None of these services provides the in-line SNS content control that the question requires.
Community Comment Notes
Bad_Mat explicitly backs this choice, stating “The correct answer is A.” and describing the need to associate a data protection policy with the SNS topic and define statements that identify and protect sensitive data. No commenter proposes a credible alternative that would redact SNS message contents before publication. The community view aligns with the native SNS data protection policy capability.
Official Reference
https://docs.aws.amazon.com/sns/latest/dg/sns-data-protection-policies.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks how to prevent sensitive data from leaving a managed messaging service, look first for that service's native data protection or content-redaction feature. Discovery tools such as Macie, threat detectors such as GuardDuty, and vulnerability scanners such as Inspector are usually distractors unless the scenario explicitly asks for finding or alerting rather than prevention.
Frequently Asked Questions
Why can't Amazon Macie redact sensitive data before an SNS publish?
Does an SNS data protection policy block or only audit sensitive data?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Bad_Mat 👍 1 Answered AThe correct answer is A. Associate a data protection policy with the SNS topic. Define policy statements that identify and protect the sensitive data.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →